./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1145606116
<...>
Warning: Permanently added '10.128.0.55' (ED25519) to the list of known hosts.
execve("./syz-executor1145606116", ["./syz-executor1145606116"], 0x7fff69732490 /* 10 vars */) = 0
brk(NULL) = 0x55558a657000
brk(0x55558a657d00) = 0x55558a657d00
arch_prctl(ARCH_SET_FS, 0x55558a657380) = 0
set_tid_address(0x55558a657650) = 5219
set_robust_list(0x55558a657660, 24) = 0
rseq(0x55558a657ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1145606116", 4096) = 28
getrandom("\x6c\xdb\xd3\x9e\x19\xec\xc0\xa1", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55558a657d00
brk(0x55558a678d00) = 0x55558a678d00
brk(0x55558a679000) = 0x55558a679000
mprotect(0x7faedaecf000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
executing program
write(1, "executing program\n", 18) = 18
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7faed2a00000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304
munmap(0x7faed2a00000, 138412032) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
close(4) = 0
mkdir("./file0", 0777) = 0
[ 56.969756][ T5219] loop0: detected capacity change from 0 to 8192
[ 56.998772][ T5219] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025
[ 57.011943][ T5219] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal
[ 57.022131][ T5219] REISERFS (device loop0): using ordered data mode
[ 57.028709][ T5219] reiserfs: using flush barriers
[ 57.034984][ T5219] REISERFS (device loop0): journal params: device ram0, size 127, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max trans age 30
[ 57.051342][ T5219] REISERFS (device loop0): checking transaction log (ram0)
[ 57.067335][ T5219] ==================================================================
[ 57.075407][ T5219] BUG: KASAN: use-after-free in reiserfs_read_locked_inode+0x20db/0x29b0
[ 57.083830][ T5219] Read of size 4 at addr ffff8880712cc000 by task syz-executor114/5219
[ 57.092053][ T5219]
[ 57.094812][ T5219] CPU: 0 UID: 0 PID: 5219 Comm: syz-executor114 Not tainted 6.12.0-rc3-syzkaller-00217-g4d939780b705 #0
[ 57.105901][ T5219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 57.115947][ T5219] Call Trace:
[ 57.119206][ T5219]
[ 57.122117][ T5219] dump_stack_lvl+0x241/0x360
[ 57.126785][ T5219] ? __pfx_dump_stack_lvl+0x10/0x10
[ 57.131967][ T5219] ? __pfx__printk+0x10/0x10
[ 57.136559][ T5219] ? _printk+0xd5/0x120
[ 57.140694][ T5219] ? __virt_addr_valid+0x183/0x530
[ 57.145787][ T5219] ? __virt_addr_valid+0x183/0x530
[ 57.150877][ T5219] print_report+0x169/0x550
[ 57.155367][ T5219] ? __virt_addr_valid+0x183/0x530
[ 57.160459][ T5219] ? __virt_addr_valid+0x183/0x530
[ 57.165556][ T5219] ? __virt_addr_valid+0x45f/0x530
[ 57.170657][ T5219] ? __phys_addr+0xba/0x170
[ 57.175161][ T5219] ? reiserfs_read_locked_inode+0x20db/0x29b0
[ 57.181224][ T5219] kasan_report+0x143/0x180
[ 57.185725][ T5219] ? reiserfs_read_locked_inode+0x20db/0x29b0
[ 57.191790][ T5219] reiserfs_read_locked_inode+0x20db/0x29b0
[ 57.197683][ T5219] ? __pfx_lock_release+0x10/0x10
[ 57.202703][ T5219] ? __pfx_reiserfs_read_locked_inode+0x10/0x10
[ 57.208949][ T5219] ? _raw_spin_unlock+0x28/0x50
[ 57.213795][ T5219] ? __pfx_reiserfs_init_locked_inode+0x10/0x10
[ 57.220038][ T5219] reiserfs_fill_super+0x1361/0x2640
[ 57.225321][ T5219] ? __pfx_reiserfs_fill_super+0x10/0x10
[ 57.230953][ T5219] ? do_raw_spin_lock+0x14f/0x370
[ 57.236064][ T5219] ? __pfx_snprintf+0x10/0x10
[ 57.240737][ T5219] ? set_blocksize+0x1f9/0x360
[ 57.245500][ T5219] ? sb_set_blocksize+0x98/0xf0
[ 57.250340][ T5219] ? setup_bdev_super+0x4e6/0x5d0
[ 57.255374][ T5219] mount_bdev+0x20a/0x2d0
[ 57.259698][ T5219] ? __pfx_reiserfs_fill_super+0x10/0x10
[ 57.265320][ T5219] ? __pfx_mount_bdev+0x10/0x10
[ 57.270187][ T5219] ? vfs_parse_fs_string+0x190/0x230
[ 57.275467][ T5219] ? __pfx_vfs_parse_fs_string+0x10/0x10
[ 57.281092][ T5219] legacy_get_tree+0xee/0x190
[ 57.285764][ T5219] ? __pfx_get_super_block+0x10/0x10
[ 57.291039][ T5219] vfs_get_tree+0x90/0x2b0
[ 57.295448][ T5219] do_new_mount+0x2be/0xb40
[ 57.299947][ T5219] ? __pfx_do_new_mount+0x10/0x10
[ 57.304968][ T5219] __se_sys_mount+0x2d6/0x3c0
[ 57.309642][ T5219] ? __pfx___se_sys_mount+0x10/0x10
[ 57.314834][ T5219] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 57.321176][ T5219] ? __irq_exit_rcu+0x100/0x1c0
[ 57.326045][ T5219] ? __x64_sys_mount+0x20/0xc0
[ 57.330816][ T5219] do_syscall_64+0xf3/0x230
[ 57.335313][ T5219] ? clear_bhb_loop+0x35/0x90
[ 57.339979][ T5219] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 57.345879][ T5219] RIP: 0033:0x7faedae5c8ca
[ 57.350292][ T5219] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 57.369888][ T5219] RSP: 002b:00007ffcd0e2fa38 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 57.378296][ T5219] RAX: ffffffffffffffda RBX: 00007ffcd0e2fa50 RCX: 00007faedae5c8ca
[ 57.386257][ T5219] RDX: 0000000020001100 RSI: 0000000020001140 RDI: 00007ffcd0e2fa50
[ 57.394218][ T5219] RBP: 0000000000000004 R08: 00007ffcd0e2fa90 R09: 00000000000010e2
[ 57.402271][ T5219] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000
[ 57.410231][ T5219] R13: 00007ffcd0e2fa90 R14: 0000000000000003 R15: 0000000000400000
[ 57.418201][ T5219]
[ 57.421403][ T5219]
[ 57.423716][ T5219] The buggy address belongs to the physical page:
[ 57.430293][ T5219] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x712cc
[ 57.439040][ T5219] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 57.446150][ T5219] raw: 00fff00000000000 ffffea0001c4b348 ffff8880b8644af0 0000000000000000
[ 57.454722][ T5219] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 57.463375][ T5219] page dumped because: kasan: bad access detected
[ 57.469780][ T5219] page_owner tracks the page as freed
[ 57.475134][ T5219] page last allocated via order 0, migratetype Movable, gfp_mask 0x8(__GFP_MOVABLE), pid 1, tgid 1 (swapper/0), ts 11990774219, free_ts 13117723763
[ 57.490141][ T5219] post_alloc_hook+0x1f3/0x230
[ 57.494903][ T5219] alloc_contig_range_noprof+0x821/0xe00
[ 57.500521][ T5219] alloc_contig_pages_noprof+0x4b3/0x5c0
[ 57.506145][ T5219] debug_vm_pgtable_alloc_huge_page+0xaf/0x100
[ 57.512311][ T5219] init_args+0x83b/0xb20
[ 57.516576][ T5219] debug_vm_pgtable+0xe0/0x550
[ 57.521351][ T5219] do_one_initcall+0x248/0x880
[ 57.526150][ T5219] do_initcall_level+0x157/0x210
[ 57.531077][ T5219] do_initcalls+0x3f/0x80
[ 57.535483][ T5219] kernel_init_freeable+0x435/0x5d0
[ 57.540668][ T5219] kernel_init+0x1d/0x2b0
[ 57.545001][ T5219] ret_from_fork+0x4b/0x80
[ 57.549410][ T5219] ret_from_fork_asm+0x1a/0x30
[ 57.554166][ T5219] page last free pid 1 tgid 1 stack trace:
[ 57.559953][ T5219] free_unref_page+0xcd0/0xf00
[ 57.564710][ T5219] free_contig_range+0x152/0x550
[ 57.569635][ T5219] destroy_args+0x8a/0x840
[ 57.574041][ T5219] debug_vm_pgtable+0x4be/0x550
[ 57.578885][ T5219] do_one_initcall+0x248/0x880
[ 57.583638][ T5219] do_initcall_level+0x157/0x210
[ 57.588565][ T5219] do_initcalls+0x3f/0x80
[ 57.592886][ T5219] kernel_init_freeable+0x435/0x5d0
[ 57.598073][ T5219] kernel_init+0x1d/0x2b0
[ 57.602393][ T5219] ret_from_fork+0x4b/0x80
[ 57.606807][ T5219] ret_from_fork_asm+0x1a/0x30
[ 57.611567][ T5219]
[ 57.613886][ T5219] Memory state around the buggy address:
[ 57.619502][ T5219] ffff8880712cbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 57.627550][ T5219] ffff8880712cbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 57.635599][ T5219] >ffff8880712cc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 57.643642][ T5219] ^
[ 57.647695][ T5219] ffff8880712cc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 57.655742][ T5219] ffff8880712cc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 57.663788][ T5219] ==================================================================
[ 57.672070][ T5219] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 57.679273][ T5219] CPU: 0 UID: 0 PID: 5219 Comm: syz-executor114 Not tainted 6.12.0-rc3-syzkaller-00217-g4d939780b705 #0
[ 57.690395][ T5219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 57.700441][ T5219] Call Trace:
[ 57.703756][ T5219]
[ 57.706680][ T5219] dump_stack_lvl+0x241/0x360
[ 57.711370][ T5219] ? __pfx_dump_stack_lvl+0x10/0x10
[ 57.716559][ T5219] ? __pfx__printk+0x10/0x10
[ 57.721137][ T5219] ? lock_release+0xbf/0xa30
[ 57.725724][ T5219] ? vscnprintf+0x5d/0x90
[ 57.730107][ T5219] panic+0x349/0x880
[ 57.734015][ T5219] ? check_panic_on_warn+0x21/0xb0
[ 57.739133][ T5219] ? __pfx_panic+0x10/0x10
[ 57.743570][ T5219] ? mark_lock+0x9a/0x360
[ 57.747894][ T5219] ? _raw_spin_unlock_irqrestore+0xd8/0x140
[ 57.753782][ T5219] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 57.759672][ T5219] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 57.765994][ T5219] ? print_report+0x502/0x550
[ 57.770672][ T5219] check_panic_on_warn+0x86/0xb0
[ 57.775600][ T5219] ? reiserfs_read_locked_inode+0x20db/0x29b0
[ 57.781661][ T5219] end_report+0x77/0x160
[ 57.785901][ T5219] kasan_report+0x154/0x180
[ 57.790400][ T5219] ? reiserfs_read_locked_inode+0x20db/0x29b0
[ 57.796464][ T5219] reiserfs_read_locked_inode+0x20db/0x29b0
[ 57.802358][ T5219] ? __pfx_lock_release+0x10/0x10
[ 57.807381][ T5219] ? __pfx_reiserfs_read_locked_inode+0x10/0x10
[ 57.813619][ T5219] ? _raw_spin_unlock+0x28/0x50
[ 57.818470][ T5219] ? __pfx_reiserfs_init_locked_inode+0x10/0x10
[ 57.824713][ T5219] reiserfs_fill_super+0x1361/0x2640
[ 57.829997][ T5219] ? __pfx_reiserfs_fill_super+0x10/0x10
[ 57.835624][ T5219] ? do_raw_spin_lock+0x14f/0x370
[ 57.840642][ T5219] ? __pfx_snprintf+0x10/0x10
[ 57.845312][ T5219] ? set_blocksize+0x1f9/0x360
[ 57.850066][ T5219] ? sb_set_blocksize+0x98/0xf0
[ 57.854908][ T5219] ? setup_bdev_super+0x4e6/0x5d0
[ 57.859927][ T5219] mount_bdev+0x20a/0x2d0
[ 57.864255][ T5219] ? __pfx_reiserfs_fill_super+0x10/0x10
[ 57.869878][ T5219] ? __pfx_mount_bdev+0x10/0x10
[ 57.874722][ T5219] ? vfs_parse_fs_string+0x190/0x230
[ 57.880010][ T5219] ? __pfx_vfs_parse_fs_string+0x10/0x10
[ 57.885636][ T5219] legacy_get_tree+0xee/0x190
[ 57.890308][ T5219] ? __pfx_get_super_block+0x10/0x10
[ 57.895586][ T5219] vfs_get_tree+0x90/0x2b0
[ 57.899996][ T5219] do_new_mount+0x2be/0xb40
[ 57.904497][ T5219] ? __pfx_do_new_mount+0x10/0x10
[ 57.909521][ T5219] __se_sys_mount+0x2d6/0x3c0
[ 57.914279][ T5219] ? __pfx___se_sys_mount+0x10/0x10
[ 57.919472][ T5219] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 57.925791][ T5219] ? __irq_exit_rcu+0x100/0x1c0
[ 57.930635][ T5219] ? __x64_sys_mount+0x20/0xc0
[ 57.935393][ T5219] do_syscall_64+0xf3/0x230
[ 57.939887][ T5219] ? clear_bhb_loop+0x35/0x90
[ 57.944557][ T5219] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 57.950447][ T5219] RIP: 0033:0x7faedae5c8ca
[ 57.954867][ T5219] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 57.974480][ T5219] RSP: 002b:00007ffcd0e2fa38 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 57.982888][ T5219] RAX: ffffffffffffffda RBX: 00007ffcd0e2fa50 RCX: 00007faedae5c8ca
[ 57.990852][ T5219] RDX: 0000000020001100 RSI: 0000000020001140 RDI: 00007ffcd0e2fa50
[ 57.998821][ T5219] RBP: 0000000000000004 R08: 00007ffcd0e2fa90 R09: 00000000000010e2
[ 58.006784][ T5219] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000
[ 58.014837][ T5219] R13: 00007ffcd0e2fa90 R14: 0000000000000003 R15: 0000000000400000
[ 58.022804][ T5219]
[ 58.026140][ T5219] Kernel Offset: disabled
[ 58.030548][ T5219] Rebooting in 86400 seconds..